Segway G3 Max: VCU dump and flash

⚠️ Warning

The scooter's warranty will be voided!
You perform these actions at your own risk. Possible consequences:

• VCU controller failure
• Unstable scooter performance

What is in this repository

Component	Location	Purpose
Dump / flash scripts	fix_vcu/ (this repo)	ST-Link + bundled openocd.exe (Windows) and oocd/scripts/
Dump editor	change_sn project	Patch MEMORY_G3*.bin: SN, firmware key, SHU prep

The release package ships the editor binary as fix_vcu-<os>-<arch> (historical build name from the change_sn repo). Use it together with the dump/flash scripts from this folder.

Target MCU: AT32F415CBT7 (128 KB flash).

📋 Required components

1. Hardware:

   • ST-Link v2 programmer
   • DUPON cables
   • Soldering iron (for TP13V3 contact)

2. Software:

   • [STLink driver]
   • Release — fix_vcu-… binary (dump editor) + dump/flash scripts

🛠 Preparation

Windows (primary platform)

1. Install the ST-Link driver (dpinst_amd64.exe if included in the release package).
2. Extract to a folder without non-ASCII characters in the path.
3. OpenOCD is bundled in the repo — no separate build required:
   • openocd.exe — binary in the fix_vcu/ root
   • oocd/scripts/ — configs and helper scripts (AT32, ST-Link)
4. Run .bat files from the fix_vcu/ directory (openocd.exe and oocd/ must be next to the scripts).

File	Purpose
dump_memory.bat	Read dump → MEMORY_G3.bin
fix_vcu-windows-….exe	Dump editor (built from change_sn)
flash_memory_patched.bat	Flash MEMORY_G3.bin.patched.bin
fix_option_bytes.bat	Clear flash protection on write-protected errors

macOS / Linux

A prebuilt OpenOCD binary is included for Windows only (openocd.exe). On macOS there are *_mac.sh helpers, but they expect either:

• a local build at .local/openocd-artery/bin/openocd via build_openocd_artery_mac.sh, or
• openocd on your PATH (e.g. Homebrew) if you skip the local build.

chmod +x build_openocd_artery_mac.sh
./build_openocd_artery_mac.sh "https://github.com/ArteryTek/openocd.git" "$(pwd)/.build" "$(pwd)/.local/openocd-artery"

Scripts: dump_memory_mac.sh, flash_memory_patched_mac.sh, fix_option_bytes_mac.sh.

🔌 ST-Link connection

Check your ST-Link pinout before connecting.

Important! Disconnect the VCU from the scooter before starting.

No.	ST-Link	VCU
1	SWDIO	DIO
2	SWCLK	CLK
3	GND	GND
4	3.3V	TP13V3*
5	GND**	C45 (temporary)

*Soldering required (fragile contact!)
**Used only for shorting to C45

🔄 Modification process

1. Creating a dump

1. Short pin 5 (GND) to C45
2. Run dump_memory.bat (or dump_memory_mac.sh)
3. When oocd\scripts/mem_helper.tcl", line 37 appears, release the short
4. Verify MEMORY_G3.bin exists (128 KB)
5. In a hex editor (e.g. HxD): Goto 0x1F020 — your serial should appear twice. If not, the dump is bad; redo step 1.

2. Editing the dump (change_sn / fix_vcu-….exe)

Run the release editor binary in the folder with MEMORY_G3.bin.

Menu:

Option	Action
1	Your dump: change SN, view/transfer firmware key (VCU version auto-detected)
2	Other firmware: copy SN + key from your dump into a DUMPS/ template
3	Make my dump flashable with SHU — erase 22-byte key (0xFF) before SHU Compat flash
4	Set firmware key manually (22 characters)

Output: MEMORY_G3.bin.patched.bin.

Region change: option 1 → update SN (14 chars, template 1CGCC++++C++++).

SHU Compat firmware: before flashing Compat images, use option 3 so the dump key at 0x1420 / 0x10420 becomes 0xFF×22. Details: change_sn/README.md, G3_full_dump_key_version_change_sn.md.

The editor does not modify mileage or speed limits in the dump (removed).

3. Flashing

1. Short GND to C45 again
2. Run flash_memory_patched.bat
3. Release the short when oocd\scripts/mem_helper.tcl", line 37 appears
4. Success when you see: wrote 131072 bytes from file MEMORY_G3.bin.patched.bin to flash bank 0 …

If flash memory write protected:

• Windows: fix_option_bytes.bat
• macOS: ./fix_option_bytes_mac.sh

Important: this script clears write protection (option bytes), but the Flash contents are zeroed — firmware on the VCU is erased and you cannot dump it afterward. Run fix_option_bytes only if you already have a known-good dump (MEMORY_G3*.bin) backed up and verified.

Power-cycle the VCU and retry flashing (use your prepared .patched.bin).

If flash write algorithm aborted by target, add -c "set WORKAREASIZE 0" before -f .../at32.cfg in the OpenOCD command.

❌ Possible errors

• open failed → check ST-Link on the PC
• init mode failed → check VCU wiring

SN already bound to another account:

1. Run the dump editor → option 1
2. Select MEMORY_G3.bin.patched.bin
3. Enter a new 14-character SN
4. Flash the new .patched.bin

SHU / Compat flash issues:

1. Menu option 3 (make my dump flashable with SHU) on MEMORY_G3.bin
2. Flash the resulting .patched.bin, then apply Compat firmware via SHU